CVE-2024-29891

2 advisories.

Go/github.com/zitadel/zitadel CVE-2024-29891: high 8.7, EPSS 0.76%

ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass

Action: Upgrade github.com/zitadel/zitadel to 2.42.17 or later.

go get github.com/zitadel/zitadel@v2.42.17

go get github.com/zitadel/zitadel@v2.43.11

go get github.com/zitadel/zitadel@v2.44.7

go get github.com/zitadel/zitadel@v2.45.5

go get github.com/zitadel/zitadel@v2.46.5

go get github.com/zitadel/zitadel@v2.47.8

go get github.com/zitadel/zitadel@v2.48.3

2.42.17

2.43.11

2.44.7

2.45.5

2.46.5

2.47.8

2.48.3

CVE-2024-29891 · published 2024-03-28T17:07:33Z · modified 2026-09-10T03:50:10.594180623Z · JSON

ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass in github.com/zitadel/zitadel

Action: No fix published. Pin and monitor.

introduced	fixed	last affected
0	-	-

No fixed version in the source.

CVE-2024-29891 · published 2024-06-05T15:10:52Z · modified 2024-07-09T19:33:56Z · JSON